Merge branch 'main' into rust-2024-upgrade

Author: Saul-STFC

.github/workflows/build.yaml

@@ -83,9 +83,8 @@ jobs:
           submodules: recursive
 
       - name: Install Rust ${{ env.RUST_TOOLCHAIN_VERSION }} toolchain
-        uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b
-        with:
-          toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}
+        shell: bash
+        run: rustup toolchain install "${RUST_TOOLCHAIN_VERSION}"
 
       - name: Setup Rust Cache
         uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
@@ -160,9 +159,8 @@ jobs:
         uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31.5.2
 
       - name: Install Rust ${{ env.RUST_TOOLCHAIN_VERSION }} Toolchain
-        uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b
-        with:
-          toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}
+        shell: bash
+        run: rustup toolchain install "${RUST_TOOLCHAIN_VERSION}"
 
       - name: Build Container Image
         id: build

.github/workflows/integration-test.yml

@@ -23,6 +23,8 @@ on:
       test:
         description: Name of the test. Only used of test-mode is `custom`
 
+permissions: {}
+
 jobs:
   test:
     name: Run Integration Test

.github/workflows/pr_prek.yaml

@@ -5,12 +5,13 @@ on:
   pull_request:
   merge_group:
 
+permissions: {}
+
 env:
   CARGO_TERM_COLOR: always
   NIX_PKG_MANAGER_VERSION: "2.33.3"
   RUST_TOOLCHAIN_VERSION: "nightly-2026-02-24"
   HADOLINT_VERSION: "v2.14.0"
-  PYTHON_VERSION: "3.14"
   JINJA2_CLI_VERSION: "1.0.0"
 
 jobs:
@@ -29,7 +30,6 @@ jobs:
           fetch-depth: 0
       - uses: stackabletech/actions/run-prek@a14cbd08d9e034e2361ea9205b32aff0491885db # v0.15.0
         with:
-          python-version: ${{ env.PYTHON_VERSION }}
           rust: ${{ env.RUST_TOOLCHAIN_VERSION }}
           hadolint: ${{ env.HADOLINT_VERSION }}
           nix: ${{ env.NIX_PKG_MANAGER_VERSION }}

.pre-commit-config.yaml

@@ -38,6 +38,10 @@ repos:
     hooks:
       - id: shellcheck
         args: ["--severity=info"]
+        # Temporarily needed until all getting_started.sh.j2 scripts are made non-executable.
+        # As long as they are, prek will treat them as shell scripts and so this hook will fail.
+        # pre-commit behaves differently apparently and doesn't pass .j2 files to this hook.
+        exclude: \.j2$
 
   # WARNING (@NickLarsenNZ): Nix users need to install ruff first.
   # If you do not, you will need to delete the cached ruff binary shown in the

CHANGELOG.md

@@ -8,6 +8,8 @@ All notable changes to this project will be documented in this file.
 
 - Support configuring the name of the key in the ConfigMap/Secret, in which the PEM encoded CA certificate of the Truststore should be placed.
   This is e.g. needed to be able to use the generated Secret within an OpenShift Ingress ([#679]).
+- Support adding domain components to the subject DN of TLS certificates with the volume annotation
+  `secrets.stackable.tech/backend.autotls.cert.domain-components-in-subject-dn` ([#708]).
 
 ### Changed
 
@@ -21,6 +23,7 @@ All notable changes to this project will be documented in this file.
 [#693]: https://github.com/stackabletech/secret-operator/pull/693
 [#706]: https://github.com/stackabletech/secret-operator/pull/706
 [#707]: https://github.com/stackabletech/secret-operator/pull/707
+[#708]: https://github.com/stackabletech/secret-operator/pull/708
 
 ## [26.3.0] - 2026-03-16